Windows DHCP Server CVE-2026-85865

Exploitation requires local access to a Windows Server (or Windows 10 1607/1809) host that has the DHCP Server role installed and running, and the attacker must already possess low-level authenticated privileges on that host (CVSS PR:L) - it cannot be triggered remotely or by an unauthenticated user. No user interaction is needed (UI:N). The impact is confined to an integrity-only security-feature bypass within DHCP Server (C:N/A:N), so limiting factors are the prerequisite local authenticated foothold and the fact that only servers actually running the DHCP role are affected; the specific configuration or feature targeted is not disclosed in the vendor advisory.

This is a genuinely moderate, low-urgency issue rather than a high-priority emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, score 5.5) describes a locally exploitable flaw requiring the attacker to already hold low-level privileges on the host, with impact limited to integrity (a security-feature bypass) and no confidentiality or availability effect. Multiple signals agree that this is not under active attack: no CISA KEV listing, no public POC identified, and CISA's SSVC decision framework rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial'. These are all consistent and point to low real-world risk despite the integrity bypass. The main caveat is that Microsoft's MSRC advisory (the sole substantive source) provides no technical detail about which specific DHCP security feature is bypassed, so the practical consequence of the integrity impact cannot be independently characterized - verify the exact protected control with the vendor. No EPSS score was provided in the input, so exploitation probability could not be weighed quantitatively.

An attacker who already has an authenticated low-privilege foothold on a Windows Server running the DHCP Server role locally manipulates the service to defeat one of its security checks (an improper-authentication / authentication-bypass weakness, CWE-288), undermining the integrity of a DHCP security feature. No public exploit code has been identified, and the attack requires local access with existing privileges, so this is a privilege/security-control bypass on an already-compromised host rather than a remote entry point.